Comparison
Admission controllervsPolicy as code
Admission controller
the deployment was rejected at submission because the image was unsigned and it asked to run as root.
A hook in the control plane that inspects, rejects or modifies objects as they are submitted, before anything is scheduled. It is where policy becomes enforcement rather than a report, and it is also the standard way to inject sidecars and defaults. Its risk is availability: a webhook that is slow or down can block every change to the cluster, which is why failure behaviour and timeouts are the settings that matter most.
Full entry →Policy as code
the rule that every workload must set resource limits is a file with tests, and it fails the pipeline rather than a review.
Expressing organisational rules as executable, versioned, testable code evaluated automatically. It converts standards from documents people are supposed to have read into checks that run, and it makes exceptions explicit and reviewable rather than tacit. Rolling it out in report-only mode first is essential, because a policy applied to an existing estate always turns out to have more violations than anyone predicted.
Full entry →